Every one of these sites is infected

[SUBMAN1]

http://search.yahoo.com/search;_ylt=A0geu5m2yw9I41EA.JpXNyoA?p=nihaorr1&y=Search&fr=yfp-t-501&ei=UTF-8

Too funny - even the EPA, United Nations, and UK's Civil Service all seem to have been hacked! This nihaorr1 malware javascript redirect is on all of them!

-S

[SUBMAN1]

Just saw that cancer.gov is also infected.

Mapquest is infected!

Just saw Microsoft too.

-S

[AVGWarhawk]

Lucky for me I stick the the porn sites. I expect this from them. No surprises.

[SUBMAN1]

Lucky for me I stick the the porn sites. I expect this from them. No surprises.:rotfl::rotfl::rotfl:

-S

[STEED]

Lucky for me I stick the the porn sites. I expect this from them. No surprises.

Are you wearing a rain coat?

[FIREWALL]

Lucky for me I stick the the porn sites. I expect this from them. No surprises.


:rotfl: :up: :rotfl: :up: :rotfl: :up:

[AVGWarhawk]

Lucky for me I stick the the porn sites. I expect this from them. No surprises.
Are you wearing a rain coat?
How did you guess:o

[Zayphod]

http://search.yahoo.com/search;_ylt=A0geu5m2yw9I41EA.JpXNyoA?p=nihaorr1&y=Search&fr=yfp-t-501&ei=UTF-8

Too funny - even the EPA, United Nations, and UK's Civil Service all seem to have been hacked! This nihaorr1 malware javascript redirect is on all of them!

-S

Send info back to the mothership:

Domain Name: NIHAORR1.COM
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
Name Server: DNS.51YM.COM
Name Server: DNS1.51YM.COM
Status: ok
Updated Date: 11-apr-2008
Creation Date: 11-apr-2008
Expiration Date: 11-apr-2009

Go to http://groups.google.com/ and do a search for XIN NET TECHNOLOGY
and you'll see 1380 hits on them. They're the registrar of choice for the viagra
and fake watch spams going out now. There's also a theory going around in
news.admin.net-abuse.email that xin net is actually the hand of the Russian
Business Network criminal network.

Xin Net Technology link:http://tinyurl.com/5uw2sf (http://tinyurl.com/5uw2sf)

http://www.spamhaus.org/rokso/searchresults.lasso
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK6158